Privacy Policy

1. Who Operates Rezumz

Rezumz is operated by First Stone Labs. First Stone Labs is not currently a formally registered legal entity (no incorporated company, LLC, or equivalent) — this is disclosed here for transparency and should be resolved (proper incorporation, a registered business address, and a defined governing jurisdiction) before this policy is finalized or relied upon as a complete legal document, particularly given Rezumz now processes personal data internationally.

2. What We Collect

• Account data: if you create an account (email/password or Google sign-in), we store your email, name, and — if you're a job seeker or recruiter — the role you selected at signup.
• Resume & career content: resumes, interview prep sets, job-description analyses, and (for recruiters) job postings and uploaded candidate resumes are stored on our servers, tied to your account, so they sync across devices and sessions.
• Public CV pages: if you publish a public CV (cv.rezumz.com), the page content is publicly readable by design; contact details behind the password-gated reveal are stored separately and are never publicly queryable.
• Usage & analytics data: we use Google Analytics (GA4) and PostHog to understand product usage — this includes standard web analytics data (pages viewed, general location inferred from IP, device/browser type) and in-product events (e.g. which AI tool you used). We do not use third-party advertising trackers.
• Payment data: handled entirely by Dodo Payments — we never see or store your card details, only a payment/license confirmation used to grant access.

3. Recruiter Tools & Candidate Data

If you use the recruiter Resume Analyzer, you upload other people's resumes — those candidates are not Rezumz users and have not agreed to these terms. When you upload a candidate's resume, we store the extracted text, an inferred name, and an AI-generated match score, tied to your recruiter account, until you delete the associated job posting.

By uploading a candidate's resume, you (the recruiter) confirm you have a lawful basis to process that person's data for recruitment purposes (e.g. they applied to your posting). In this relationship, you act as the data controller for candidate data and Rezumz acts as a data processor on your behalf, processing it only to provide the screening/scoring feature back to you.

4. What Passes Through Our Servers Without Being Stored

• AI requests: when you use an AI feature, the relevant resume/job-description text is sent to our server and forwarded to Anthropic's API to produce a response. The request content itself is not separately stored beyond what's described in Section 2 above.
• Uploaded files for parsing: a PDF/DOCX/TXT file you upload is processed on our server to extract text; the original file is not saved to disk after extraction.

5. Sub-Processors & Where Data Is Stored

We use the following third parties to operate Rezumz, each governed by its own privacy policy:

• Supabase — database and authentication. Data is hosted in the United States (us-east-1).
• Anthropic — AI processing for resume/CV generation and analysis features.
• Resend — sending email (interview links, scheduling and sign-in emails) and receiving CVs forwarded to a recruiter's inbox address.
• Dodo Payments — payment processing.
• Vercel — application hosting.
• Google — Google sign-in (if you use it) and Google Analytics.
• PostHog — in-product analytics.

Because our infrastructure is US-based, your data is processed and stored in the United States regardless of where you access Rezumz from — including if you're located in the EU/EEA, UK, UAE, or elsewhere. We rely on our sub-processors' own international-transfer safeguards (e.g. standard contractual clauses where applicable); a fully documented transfer mechanism should be confirmed with a lawyer before this is treated as GDPR-complete.

6. Your Rights

Regardless of your location, you can request to access, correct, export, or delete your personal data by using our privacy request form or emailing us (see Contact below). If you're in the EU/EEA, UK, or another jurisdiction with statutory data-protection rights (access, rectification, erasure, restriction of processing, data portability, and objection to processing), those rights apply to your data on the same basis — we aim to honor these requests promptly. A candidate whose resume was uploaded by a recruiter (see Section 3) should direct data requests to that recruiter in the first instance, or to us directly if that isn't possible.

6a. Additional information for the EU, EEA and UK (GDPR)

Our two roles. For your own account data (your email, name and what you create), First Stone Labs is the controller. For candidate data a recruiter uploads or collects through a Rezumz apply page, the recruiter's organisation is the controller and Rezumz is its processor, under the data processing agreement. If you applied to a company that uses Rezumz, that company decides what happens to your data.

Our legal bases as a controller. Performing our contract with you (providing the service); our legitimate interests in keeping the service secure, preventing abuse and improving the product; and your consent where we ask for it. Where the law requires us to keep something, a legal obligation.

How long we keep it. Account data until you delete your account. Candidate data until the controller deletes it, or after the number of months a recruiter chooses to set on a job. Deleted data is removed from our live systems, and may remain in our providers' backups for a limited time.

Transfers. Our infrastructure is in the United States (see section 5). For transfers from the EU, EEA or UK we rely on the safeguards the law provides, such as standard contractual clauses, to be confirmed in a signed agreement.

Automated decisions. Match scores and AI summaries are an aid to a person. Rezumz does not make solely automated decisions about candidates, and nothing is rejected or emailed automatically.

Your rights and how to use them. You can ask to access, correct, delete, restrict or object to the use of your data, and to receive it in a portable form. Use the privacy request form and we will reply within 30 days. You can also complain to your local data protection authority.

Not yet in place. We have not yet confirmed whether an EU or UK representative is required, and there is no EU hosting option. See the Trust Centre for the full list.

6b. California privacy rights (CCPA and CPRA)

Whether or not the California Consumer Privacy Act applies to us yet, we handle California residents' requests as it describes.

What we collect. Identifiers (name, email), internet activity (pages viewed and product events), professional or employment information (CVs, job history and interview feedback that recruiters upload or collect), and inferences (match scores and summaries). We collect it from you, and for candidates from the recruiter or company that received their application. We use it to provide and secure the service, as described above.

We do not sell personal information, and we do not share it for cross-context behavioural advertising. We do not use sensitive personal information beyond what is needed to provide the service.

Your rights. You can ask what we hold about you, ask us to delete or correct it, and you will not be treated worse for asking. An authorised agent can make a request for you. We may need to confirm it is you. We reply within 45 days, and use the privacy request form for requests.

Candidates. Where we process a candidate's data as a service provider for the business that received their application, that business responds to the request, and we help it do so.

7. Cookies & Tracking

We use cookies for authentication (keeping you signed in) and analytics (Google Analytics, PostHog). We do not use third-party advertising trackers.

8. Children's Privacy

Rezumz is not directed at children under 16 and we do not knowingly collect data from them.

9. Changes

We may update this policy as the product evolves. Material changes will be reflected here with an updated date.

10. Contact

Questions or requests about this policy, including data access/deletion requests: firststonelabs@gmail.com.